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The Honorable Ed Chau 
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Sacramento, CA 95814 

RE: California Consumer Privacy Act of 2018 

Dear Assemblymember Chau and Senator Hertzberg: 


The Honorable Robert M. Hertzberg 
California State Senate 
State Capitol 
Sacramento, CA 95814 


As you work your way toward a fruitful conclusion to the legislative session, I write to 
reemphasize what I have expressed previously to you and our legislative leaders and Governor 
Brown concerning the recently enacted California Consumer Privacy Act of 2018 (CCPA). I 
appreciate your leadership and share your commitment in protecting consumer privacy and the 
goals of the CCPA. However, as I have warned before, the CCPA imposes several unworkable 
obligations and senous operational challenges upon the Attorney General’s Office (AGO) the 
agency charged with its oversight and enforcement. And, as I have stressed on numerous ’ 
occasions, failure to cure these identified flaws will undermine California’s authority to launch 

and sustain vigorous oversight and effective enforcement of the CCPA’s critical privacv 
protections. ’’ 

AGO’S five primary concerns with the existing language in the 
CCPA, First section 1798.155 of the CCPA requires the AGO to provide opinions to “[a]ny 
business or third party” as well as warnings and an opportunity to cure to a business before the 
business can be held accountable for a violation of the CCPA. Requiring the AGO to provide 
l^m counsel at taxpayers’ expense to all inquiring businesses creates the unprecedented 
obligation of using public funds to provide unlimited legal advice to private parties. This 
provision also creates a potential conflict of interest by having the AGO provide legal advice to 
parties who may be violating the privacy rights of Californians, the very people that the AGO is 
sworn to protect. What could be more unfair and unconscionable than to advantage violators of 
consumers privacy by providing them with legal counsel at taxpayer expense but leaving the 
victims of the privacy violation on their own? I do not see how the AGO can comply with these 
requirements. I urge you to swiftly correct this. 

/ penalty provisions are likely unconstitutional. These provisions 

^ee Civil Code section 1798.155 and 1798,160) purport to amend and modify the Unfair 

(UCL) civil penalty provision (see Business and Professions Code section 
17206) as applied to CCPA violations. The UCL’s civil penalty provisions were enacted by the 
voters through Proposition 64 in 2004 and cannot be amended through legislation (see Cal. 
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Const, ait, II. § 10). Wc can and should address this constitutional infirmity by simply replacing 
the CCPA s current penalty provision with a conventional stand-alone enforcement provision 
that does not purport to modily the UCL. My team has offered corrective language for this 
purpose. 

Third, the CCPA contains an unnecessary requirement that private plaintiffs give notice 
to the Attorney General before filing suit (sec Civil Code section 1798.150, subdivision (b)(2)). 
This provision has no purpose as the courts not the Attorney General decide the merits of private 
lawsuits. Additionally, the filing of a private action docs not limit the Attorney General’s law 
enforcement authority. This provision in the CCPA imposes unnecessary personnel and 
administrative costs on the AGO and it, too. .should be eliminated. 

Fourth, undci the CCPA, the AGO has one year to conduct rulemaking for this newly 
established body of law (see Civil Code section 1798.185, including at subdivisions (a)(3). (4). 
(6), and (7)). But the CCPA provided no resources for the AGO to carry out this rule-making - 
or even its implementation thereafter. The nature and pace of the rule-making process, especially 
in light of the broad public interest in privacy issues, does not lend itself to a short-circuited 
timeframe to formulate the rules that will govern the oversight and enforcement of the CCPA’s 
privacy rights. A one-year deadline to establish implementing regulations for the CCPA arc 
simply unattainable: regulations of this magnitude require time - more than one year; the AGO 
has received no resources for this purpose; and it must be recognized that the AGO is being 
asked to take on the new role and obligations of a regulator (the AGO’s role has been and is that 
of an enforcer). The Attorney General’s Office must be given a sufficient and realistic amount of 
time to issue strong, enforceable regulations. 


Finally, the CCPA does not include a private right of action that would allow consumers 
to seek legal remedies for themselves to protect their privacy. Instead, the Act includes a 
provision that gives consumers a limited right to sue if they become a victim of a data breach 
1 he lack of a private right of aefton. which would provide a critical adjunct to governmental 
en orcement, will substantially increase the AGO’s need for new enforcement resources. I urge 
you to provide consumers with a private right of action under the CCPA. 

Providing Californians with privacy protections is critically important now more than 
ever. However, the CCPA as it currently applies to the Attorney General’s Office presents 

serious operational challenges. If we fail to address these issues with 
the CCPA as outlined above, it is the people of California who stand to lo.se. 
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CC: Speaker Anthony Rendon 

Senate Pro Tern Toni Atkins 
Senator William Dodd 



